gerrit.onap Code Review - portal/sdk.git/blob

   1 /*
   2  * ============LICENSE_START==========================================
   3  * ONAP Portal SDK
   4  * ===================================================================
   5  * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
   6  * ===================================================================
   7  *
   8  * Unless otherwise specified, all software contained herein is licensed
   9  * under the Apache License, Version 2.0 (the “License”);
  10  * you may not use this software except in compliance with the License.
  11  * You may obtain a copy of the License at
  12  *
  13  *             http://www.apache.org/licenses/LICENSE-2.0
  14  *
  15  * Unless required by applicable law or agreed to in writing, software
  16  * distributed under the License is distributed on an "AS IS" BASIS,
  17  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18  * See the License for the specific language governing permissions and
  19  * limitations under the License.
  20  *
  21  * Unless otherwise specified, all documentation contained herein is licensed
  22  * under the Creative Commons License, Attribution 4.0 Intl. (the “License”);
  23  * you may not use this documentation except in compliance with the License.
  24  * You may obtain a copy of the License at
  25  *
  26  *             https://creativecommons.org/licenses/by/4.0/
  27  *
  28  * Unless required by applicable law or agreed to in writing, documentation
  29  * distributed under the License is distributed on an "AS IS" BASIS,
  30  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  31  * See the License for the specific language governing permissions and
  32  * limitations under the License.
  33  *
  34  * ============LICENSE_END============================================
  35  *
  36  * ECOMP is a trademark and service mark of AT&T Intellectual Property.
  37  */
  38 package org.onap.portalapp.controller.core;
  39
  40 import java.net.URLDecoder;
  41 import java.net.URLEncoder;
  42 import java.util.HashMap;
  43 import java.util.List;
  44 import java.util.Map;
  45
  46 import javax.servlet.http.Cookie;
  47 import javax.servlet.http.HttpServletRequest;
  48 import javax.servlet.http.HttpSession;
  49
  50 import org.onap.portalsdk.core.auth.LoginStrategy;
  51 import org.onap.portalsdk.core.command.LoginBean;
  52 import org.onap.portalsdk.core.controller.UnRestrictedBaseController;
  53 import org.onap.portalsdk.core.domain.RoleFunction;
  54 import org.onap.portalsdk.core.domain.User;
  55 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
  56 import org.onap.portalsdk.core.menu.MenuProperties;
  57 import org.onap.portalsdk.core.onboarding.listener.PortalTimeoutHandler;
  58 import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
  59 import org.onap.portalsdk.core.onboarding.util.PortalApiProperties;
  60 import org.onap.portalsdk.core.service.LoginService;
  61 import org.onap.portalsdk.core.service.RoleService;
  62 import org.onap.portalsdk.core.util.SystemProperties;
  63 import org.onap.portalsdk.core.web.support.AppUtils;
  64 import org.onap.portalsdk.core.web.support.UserUtils;
  65 import org.springframework.beans.factory.annotation.Autowired;
  66 import org.springframework.stereotype.Controller;
  67 import org.springframework.web.bind.annotation.RequestMapping;
  68 import org.springframework.web.bind.annotation.RequestMethod;
  69 import org.springframework.web.servlet.ModelAndView;
  70 import org.springframework.web.util.WebUtils;
  71
  72 @Controller
  73 @RequestMapping("/")
  74 public class SingleSignOnController extends UnRestrictedBaseController {
  75
  76         private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SingleSignOnController.class);
  77
  78         @Autowired
  79         private LoginService loginService;
  80
  81         @Autowired
  82         private LoginStrategy loginStrategy;
  83
  84         private String viewName;
  85         private String welcomeView;
  86
  87         public String getWelcomeView() {
  88                 return welcomeView;
  89         }
  90
  91         public void setWelcomeView(String welcomeView) {
  92                 this.welcomeView = welcomeView;
  93         }
  94
  95         @Autowired
  96         RoleService roleService;
  97
  98         /**
  99          * Handles requests directed to the single sign-on page by the session
 100          * timeout interceptor.
 101          *
 102          * @param request
 103          * @return Redirect to an appropriate address
 104          * @throws Exception
 105          */
 106         @RequestMapping(value = { "/single_signon.htm" }, method = RequestMethod.GET)
 107         public ModelAndView singleSignOnLogin(HttpServletRequest request) throws Exception {
 108
 109                 Map<String, String> model = new HashMap<String, String>();
 110                 HashMap<String, String> additionalParamsMap = new HashMap<String, String>();
 111                 LoginBean commandBean = new LoginBean();
 112
 113                 // SessionTimeoutInterceptor sets these parameters
 114                 String forwardURL = URLDecoder.decode(request.getParameter("forwardURL"), "UTF-8");
 115                 String redirectToPortal = request.getParameter("redirectToPortal");
 116
 117                 if (isLoginCookieExist(request) && redirectToPortal == null) {
 118                         HttpSession session = null;
 119                         session = AppUtils.getSession(request);
 120                         User user = UserUtils.getUserSession(request);
 121                         if (session == null || user == null) {
 122
 123                                 final String authMech = SystemProperties.getProperty(SystemProperties.AUTHENTICATION_MECHANISM);
 124                                 String userId = loginStrategy.getUserId(request);
 125                                 commandBean.setUserid(userId);
 126                                 commandBean = getLoginService().findUser(commandBean,
 127                                                 (String) request.getAttribute(MenuProperties.MENU_PROPERTIES_FILENAME_KEY),
 128                                                 additionalParamsMap);
 129                                 List<RoleFunction> roleFunctionList=  roleService.getRoleFunctions(userId);
 130                                 if (commandBean.getUser() == null) {
 131                                         String loginErrorMessage = (commandBean.getLoginErrorMessage() != null)
 132                                                         ? commandBean.getLoginErrorMessage()
 133                                                         : SystemProperties.MESSAGE_KEY_LOGIN_ERROR_USER_NOT_FOUND;
 134                                         model.put(LoginStrategy.ERROR_MESSAGE_KEY, SystemProperties.getProperty(loginErrorMessage));
 135                                         final String redirectUrl = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REDIRECT_URL)
 136                                                         + "?noUserError=Yes";
 137                                         logger.debug(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: user is null, redirect URL is {}",
 138                                                         redirectUrl);
 139                                         return new ModelAndView("redirect:" + redirectUrl);
 140                                 } else {
 141                                         // store the user's information in the session
 142                                         String loginMethod;
 143                                         if (null == authMech || "".equals(authMech) || "BOTH".equals(authMech)) {
 144                                                 loginMethod = SystemProperties.getProperty(SystemProperties.LOGIN_METHOD_CSP);
 145                                         } else if ("CSP".equals(authMech)) {
 146                                                 loginMethod = SystemProperties.getProperty(SystemProperties.LOGIN_METHOD_CSP);
 147                                         } else {
 148                                                 loginMethod = SystemProperties.getProperty(SystemProperties.LOGIN_METHOD_WEB_JUNCTION);
 149                                         }
 150                                         UserUtils.setUserSession(request, commandBean.getUser(), commandBean.getMenu(),
 151                                                         commandBean.getBusinessDirectMenu(), loginMethod, roleFunctionList);
 152                                         initateSessionMgtHandler(request);
 153                                         logger.debug(EELFLoggerDelegate.debugLogger,
 154                                                         "singleSignOnLogin: create new user session for expired user {}; user {} exists in the system",
 155                                                         userId, commandBean.getUser().getOrgUserId());
 156                                         return new ModelAndView("redirect:" + forwardURL);
 157                                 }
 158                         } // user is null or session is null
 159                         else {
 160                                 // both user and session are non-null.
 161                                 logger.info(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: redirecting to the forwardURL {}",
 162                                                 forwardURL);
 163                                 return new ModelAndView("redirect:" + forwardURL);
 164                         }
 165
 166                 } else {
 167                         /*
 168                          * Login cookie not found, or redirect-to-portal parameter was
 169                          * found.
 170                          *
 171                          * Redirect the user to the portal with a suitable return URL. The
 172                          * forwardURL parameter that arrives as a parameter is a partial
 173                          * (not absolute) request path for a page in the application. The
 174                          * challenge here is to compute the correct absolute path for the
 175                          * original request so the portal can redirect the user back to the
 176                          * right place. If the application sits behind WebJunction, or if
 177                          * separate FE-BE hosts are used, then the URL yielded by the
 178                          * request has a host name that is not reachable by the user.
 179                          */
 180                         String returnToAppUrl = null;
 181                         if (SystemProperties.containsProperty(SystemProperties.APP_BASE_URL)) {
 182                                 // New feature as of 1610, release 3.3.3:
 183                                 // application can publish a base URL in system.properties
 184                                 String appUrl = SystemProperties.getProperty(SystemProperties.APP_BASE_URL);
 185                                 returnToAppUrl = appUrl + (appUrl.endsWith("/") ? "" : "/") + forwardURL;
 186                                 logger.debug(EELFLoggerDelegate.debugLogger,
 187                                                 "singleSignOnLogin: using app base URL {} and redirectURL {}", appUrl, returnToAppUrl);
 188                         } else {
 189                                 // Be backward compatible with applications that don't need this
 190                                 // feature.
 191                                 // This is the controller for the single_signon.htm page, so the
 192                                 // replace
 193                                 // should always find the specified token.
 194                                 returnToAppUrl = ((HttpServletRequest) request).getRequestURL().toString().replace("single_signon.htm",
 195                                                 forwardURL);
 196                                 logger.debug(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: computed redirectURL {}",
 197                                                 returnToAppUrl);
 198                         }
 199                         final String encodedReturnToAppUrl = URLEncoder.encode(returnToAppUrl, "UTF-8");
 200                         // Also send the application's UEB key so Portal can block URL
 201                         // reflection attacks.
 202                         final String uebAppKey = PortalApiProperties.getProperty(PortalApiConstants.UEB_APP_KEY);
 203                         final String url = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REDIRECT_URL);
 204                         final String portalUrl = url.substring(0, url.lastIndexOf('/')) + "/process_csp";
 205                         final String redirectUrl = portalUrl + "?uebAppKey=" + uebAppKey + "&redirectUrl=" + encodedReturnToAppUrl;
 206                         logger.debug(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: portal-bound redirect URL is {}",
 207                                         redirectUrl);
 208                         return new ModelAndView("redirect:" + redirectUrl);
 209                 }
 210         }
 211
 212         protected void initateSessionMgtHandler(HttpServletRequest request) {
 213                 String portalJSessionId = getPortalJSessionId(request);
 214                 String jSessionId = getJessionId(request);
 215                 PortalTimeoutHandler.sessionCreated(portalJSessionId, jSessionId, AppUtils.getSession(request));
 216         }
 217
 218         public boolean isLoginCookieExist(HttpServletRequest request) {
 219                 Cookie ep = WebUtils.getCookie(request, LoginStrategy.EP_SERVICE);
 220                 return (ep != null);
 221         }
 222
 223         public String getPortalJSessionId(HttpServletRequest request) {
 224                 Cookie ep = WebUtils.getCookie(request, LoginStrategy.EP_SERVICE);
 225                 return ep.getValue();
 226         }
 227
 228         public String getJessionId(HttpServletRequest request) {
 229                 return request.getSession().getId();
 230         }
 231
 232         public String getViewName() {
 233                 return viewName;
 234         }
 235
 236         public void setViewName(String viewName) {
 237                 this.viewName = viewName;
 238         }
 239
 240         public LoginService getLoginService() {
 241                 return loginService;
 242         }
 243
 244         public void setLoginService(LoginService loginService) {
 245                 this.loginService = loginService;
 246         }
 247
 248 }